{"id":"CVE-2026-115929","kind":"vulnerability","aliases":["CVE-2026-115929"],"related":[],"title":"MongoDB Compass: bundled Electron trusts recoverable eMudhra intermediate CA certificates","description":"MongoDB Compass relies on Electron, a third-party runtime that carries its own TLS root certificate store. This root certificate store has the recoverable eMudhra intermediate CA certificates. Issue is resolved by updating to Compass 1.53.1, which includes Electron 44.9.1.","summary":"MongoDB Compass ships Electron, which carries its own TLS root certificate store that includes recoverable eMudhra intermediate CA certificates. An attacker holding those intermediate keys could issue certificates that Compass accepts as trusted.","severity":"high","cvss":7.6,"epss":0.00247,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop","electron","mongodb-compass","package"],"not_affected_if":["compass-1.53.1-or-later"],"how_to_check":"- Check the installed Compass version with `mongodb-compass --version` or in Help > About\n- Compare against `1.53.1`; anything older is affected","fix":"- Update MongoDB Compass to `1.53.1`, which includes Electron `44.9.1`","status":"open","published_at":"2026-10-24T01:17:08+00:00","first_seen_at":"2026-10-24T01:45:42+00:00","triaged_at":"2026-10-25T03:14:12+00:00","updated_at":"2026-10-25T12:38:49+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:14:12Z","model":"claude-haiku-5-5","output":{"fix":"- Update MongoDB Compass to `1.53.1`, which includes Electron `44.9.1`","reach":"network","title":"MongoDB Compass: bundled Electron trusts recoverable eMudhra intermediate CA certificates","impact":"high","summary":"MongoDB Compass ships Electron, which carries its own TLS root certificate store that includes recoverable eMudhra intermediate CA certificates. An attacker holding those intermediate keys could issue certificates that Compass accepts as trusted.","category":"package","nicknames":[],"who_cares":["mongodb-compass","electron","desktop"],"confidence":0.6,"needs_auth":"unknown","worst_case":"attacker impersonates TLS servers to Compass users via forged certificates","analyst_note":"Sources only give the NVD entry; confirm the eMudhra key-recovery details and the exploitation preconditions from NVD or the MongoDB advisory.","how_to_check":"- Check the installed Compass version with `mongodb-compass --version` or in Help > About\n- Compare against `1.53.1`; anything older is affected","needs_analyst":true,"not_affected_if":["compass-1.53.1-or-later"],"who_is_affected":"Teams that run MongoDB Compass on desktops and use it to connect over TLS are exposed through the Electron certificate store. The sources do not describe a server-side path, so the desktop client is the relevant target. Teams already on Compass 1.53.1 or later are not affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000606,"input_tokens":3311,"output_tokens":549,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-115929':13A,16A '-2026':12A,15A '1.53.1':92C '44.9.1':96C 'accept':53B 'attack':43B 'bundl':3A 'ca':9A,40B,83C 'carri':28B,67C 'certif':10A,33B,41B,50B,72C,76C,84C 'compass':2A,21B,24B,52B,57C,91C 'could':48B 'cve':11A,14A 'desktop':17B 'electron':4A,18B,26B,60C,95C 'emudhra':7A,38B,81C 'hold':44B 'includ':36B,94C 'intermedi':8A,39B,46B,82C 'issu':49B,85C 'key':47B 'mongodb':1A,20B,23B,56C 'mongodb-compass':19B 'packag':22B 'parti':64C 'recover':6A,37B,80C 'reli':58C 'resolv':87C 'root':32B,71C,75C 'runtim':65C 'ship':25B 'store':34B,73C,77C 'third':63C 'third-parti':62C 'tls':31B,70C 'trust':5A,55B 'updat':89C","nicknames":[],"mitigations":[],"who_affected":"Teams that run MongoDB Compass on desktops and use it to connect over TLS are exposed through the Electron certificate store. The sources do not describe a server-side path, so the desktop client is the relevant target. Teams already on Compass 1.53.1 or later are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-24T01:17:08+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@mongodb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115929","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115929","severity":null,"published_at":"2026-10-24T01:17:08+00:00","modified_at":"2026-10-24T01:17:08+00:00","first_seen_at":"2026-10-24T01:45:42+00:00","fetched_at":"2026-10-24T01:45:42+00:00","note":null},{"source":"epss","external_id":"CVE-2026-115929","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115929","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:49+00:00","fetched_at":"2026-10-25T12:38:49+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}